Description

The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.

Remediation

References

CVE-2014-5459

Related Vulnerabilities

Apache HTTP Server Use After Free Vulnerability (CVE-2019-10082)

Joomla Improper Input Validation Vulnerability (CVE-2016-8870)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-42118)

Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-1849)

Apache Tomcat Other Vulnerability (CVE-2007-2449)

Severity

Low

Classification

CVE-2014-5459 CWE-59

Tags

Missing Update Known Vulnerabilities